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INTRODUCTION 

1.  In  1718  the  British  Parliament  passed  an  Aet  on  the  Keeping  of  Gunpowder,  a  measure 
designed  to  limit  the  hazards  of  aeeidental  explosions.  Later,  the  Explosives  Aets  of  1875  and  1923 
introdueed  proeedures  for  licensing  of  explosives  factories  and  storehouses  based  on  such  factors 
as  the  quantities  of  explosives  involved  and  the  numbers  of  people  exposed  to  the  hazard.  Since 
then,  the  technical  basis  for  legislation  has  improved  but  the  goals  remain  largely  unchanged.  In  the 
United  Kingdom,  we  seek  by  prescriptive  rules  covering  the  design,  construction,  management  and 
operation  of  explosive  storehouses  to  minimise  the  chance  of  an  explosion  occurring.  We 
complement  these  rules  with  measures  such  as  quantity-distance  (Q-D)  standards  to  ensure  that 
workers,  the  general  public  and  property  and  materiel  are  adequately  protected  from  the  effects  of 
an  explosion  should  one  occur. 

2.  Quantity-distance  tables,  and  rules  derived  from  them,  are  intended  to  provide  an  acceptable 
degree  of  protection  from  the  potential  damaging  effects  of  various  types  and  quantities  of 
explosives.  They  do  not  provide  absolute  safety.  This  much  is  clear  from  the  fact 

that  we  generally  allow  smaller  separation  distances  for  explosive  workers  than  for  other  workers 
who  in  turn  may  enjoy  a  lesser  degree  of  protection  than  the  general  public. 

3.  Within  the  United  Kingdom,  standards  for  military  explosives  storage  including  Q-D  rules 
are  laid  down  by  the  Explosives  Storage  and  Transport  Committee  (ESTC)  of  the  Ministry  of 
Defence.  Similar  standards  are  in  place  throughout  the  NATO  nations  and  in  many  other  countries 
worldwide.  These  standards  have  the  advantage  of  proven  success  and  they  should  not  be  set  aside 
lightly.  However,  they  are  not  without  problems.  The  ESTC  fixed  rule  based  system  of  regulation 
assumes  that  an  explosion  will  occur  and  is  to  this  extent  deterministic  and  inflexible.  Waivers  and 
concession  procedures  are  need  to  deal  with  situations  outside  the  normal  limits  and  decisions  to 
grant  waivers  have  to  be  made  with  little  or  no  appreciation  of  the  potential  consequences.  The 
hazards  from  sites  controlled  by  Q-D  rules  cannot  readily  be  compared  with  the  hazards  from  other 
sources  such  as  nuclear  power  plant  or  chemical  storage.  Indeed,  the  hazards  from  explosives  falling 
in  different  UN  Hazard  Divisions  cannot  be  compared.  It  is  difficult  therefore  in  Q-D  based  regimes 
to  make  informed  decisions  about  where  to  invest  resources  so  as  to  maximise  the  benefits  of  risk 
reduction. 

4.  These  problems  began  to  be  recognised  in  the  United  Kingdom  Ministry  of  Defence 
(MODUK)  soon  after  1980  and  in  1983  work  was  begun  to  investigate  the  possibility  of  applying 
quantitative  risk  assessment  (QRA)  techniques  to  the  regulation  of  explosives  storage.  The  idea 
quickly  developed  that  the  risk  was  made  up  of  two  factors;  the  probability  of  accidental  explosion 
and  the  consequences  of  such  an  event.  These  are  precisely  the  factors  that  the  existing  fixed  rule 
based  system  based  on  prescribed  procedures  and  Q-D  standards  seeks  to  control,  and  within  the 
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Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  0MB  control  number. 
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Explosives  Storage  and  Transport  Committee  the  view  has  taken  shape  that  QRA  and  fixed  rule 
based  systems  are  different  expressions  of  the  same  basic  principles.  They  are  in  effect 
complementary  and  not  alternatives. 

5.  While  this  work  was  going  on,  the  importance  of  risk  management  in  ensuring  the  health  and 
safety  of  workers  began  to  be  more  clearly  recognised  in  legislation.  In  1989,  the  Council  of  the 
European  Communities  produced  a  Directive,  ^  the  Eramework  Directive,  requiring  employers  to  use 
risk  management  techniques.  These  requirements  were  implemented  in  UK  law  in  the  Management 
of  Health  and  Safety  at  Work  Regulations  1992.  The  process  of  risk  management  requires  that 
hazards  be  identified  and  the  risks  of  them  being  realised  are  assessed.  The  employer  must  then  act 
to  avoid  the  risks  or  to  control  them.  These  duties  are  not  absolute;  risks  are  not  to  be  reduced  at  all 
costs.  Rather,  a  balance  between  the  benefits  of  the  work  activity  and  the  risks  associated  with  it 
has  to  be  sought.  The  QRA  method  developed  to  deal  the  storage  of  explosives  by  MODUK  needs 
to  fit  into  this  legislative  framework. 

6.  The  aim  of  this  paper  is  to  describe  the  QRA  system  developed  by  the  Explosives  Storage 
and  Transport  Committee  of  the  United  Kingdom  Ministry  of  Defence  and  give  examples  of  its 
practical  application.  It  will  be  argued  that  QRA  should  be  used  with  conventional  Q-D  rule  based 
regulation  to  achieve  efficient  and  cost-effective  management  of  explosives  safety. 

DEFINITIONS 

7.  Terms  such  as  hazard  and  risk  have  commonly  understood  meanings  but  when  used  in  the 
context  of  quantitative  risk  assessment,  these  meanings  can  be  ambiguous.  Risk  in  particular  could 
be  understood  to  encompass  only  the  probability  of  an  event  such  as  an  explosion  actually  occurring 
rather  than  the  broader  concept  of  the  probability  of  a  specified  harm  arising  as  a  consequence. 
Clear  definitions  are  essential  and  the  terms  used  in  this  paper  are  explained  at  Annex  A. 

CONTROL  OF  SAFETY  OF  MOD(UK)  EXPLOSIVES  SITES 

8.  Before  an  MOD(UK)  explosives  facility  is  allowed  to  operate  it  must  be  licensed.  Licences 
are  issued  by  the  Chief  Inspector  of  Explosives  for  the  MOD  Service  or  civilian  Department  involved 
against  standards  which  are  laid  down  by  the  Explosives  Storage  and  Transport  Committee  (ESTC). 
Eor  a  licence  to  be  issued,  the  Chief  Inspector  must  be  satisfied  that  in  his  professional  judgement 
the  establishment,  when  operating  within  the  terms  of  the  licence,  will  generate  risks  which  are  both 
tolerable  and  as  low  as  is  reasonably  practicable.  In  forming  this  judgement,  the  Chief  Inspector  will 
take  due  regard  of  ESTC  advice  and  Q-D  standards  and  the  defence  imperative  need  for  the  licence. 
Having  issued  a  licence,  the  Chief  Inspector  will  carry  out  periodic  inspections  to  ensure  that  the 
licence  conditions  continue  to  be 

met.  The  licensing  and  inspection  process  is  itself  defined  in  an  ESTC  standard^  and  is  subject  to 
independent  audit. 


'  EC  Directive  89/391/EEC,  Official  Journal  of  the  European  Communities,  29  June  1989 
^  ESTC  Leaflet  No  22.  Procedures  for  Licensing  MOD  Explosives  Eacilities,  March  1994. 


9.  MOD(UK)  explosives  licences  are  issued  with  three  specific  objectives  in  mind: 


The  protection  of  MOD  personnel,  Service  and  civilian,  and  the  general  public 

The  cost  effective  protection  of  materiel 

The  maintenance  of  operational  readiness  standards. 

In  order  that  these  objectives  can  be  met,  the  explosives  and  ammunition  concerned  must  be 
designed,  manufactured  and  packaged  to  an  acceptable  standard,  properly  classified  on  the  basis  of 
the  potential  hazard  presented,  and  stored  in  buildings  constructed  and  operated  to  recognised 
standards  and  managed  by  competent  staff.  Given  that  all  of  these  controls  are  in  place,  failure  to 
meet  specified  Q-D  standards  will  not  in  itself  necessarily  preclude  the  issue  of  a  licence.  In  such 
cases,  the  Chief  Inspector  should  arrange  for  an  assessment  to  be  made  of  the  additional  risks 
generated  by  the  non-compliant  situation  before  deciding  how  best  to  proceed. 

10.  Where  the  deviation  from  Q-D  standards  is  small  and  the  additional  risks  are  minor,  this 
assessment  can  be  straightforward  and  qualitative.  For  greater  risks,  more  formal  risk  assessment 
procedures  are  required.  The  QRA  method  developed  by  the  ESTC  is  intended  to  provide  a  tool  to 
facilitate  this  formal  assessment.  The  risks  associated  with  the  actual,  non-compliant  situation  are 
assessed  and  compared  with  the  range  of  risks  given  by  situations  which  comply  with  the  Q-D 
standards.  These  latter  standards  have  been  recognised  over  many  years  to  provide  an  acceptable 
degree  of  protection  and  recent  work  has  shown  them  to  involve  risk  levels  which  are  tolerable  I 
The  risks  associated  with  them  therefore  provide  a  baseline  against  which  the  significance  of 
deviations  from  the  standards  can  be  assessed.  Using  QRA  in  this  way  has  the  added  advantage  that 
many  of  the  uncertainties  and  inaccuracies  in  the  process  are  minimised  by  the  comparison. 

THE  ESTC  QRA  METHOD 

1 1 .  The  ESTC  QRA  method  is  intended  to  provide  an  estimate  of  the  upper  bound  of  the  risk  of 
fatality  to  a  specified  individual  or  to  groups  of  individuals  from  the  handling  and  storing  of 
explosives.  In  both  cases,  that  risk  is  the  product  of  two  components: 

the  maximum  expected  frequency  of  initiation 

the  expected  lethality  consequent  on  the  maximum  credible  event. 

The  successful  operation  of  the  method  requires  the  user  to  define  details  of  the  potential  explosion 
site  including  position  coordinates;  store  size,  shape  and  construction;  store  contents  in  terms  of  net 
explosive  quantity  and  weapon  type  and  other  relevant  information  and  to  specify  population 
densities  around  the  site  for  both  workers  and  the  general  public.  Outputs  are  calculated  in  terms 
of  the  risks  to  individuals  and  societal  risk.  An  overview  of  the  system  is  given  in  Eigure  1 . 


^Risk  Management  of  Explosives  Storage;  D  J  Hewkin,  V  J  Gill,  Sqn  Edr  G  B  Jones,  I  Self  and 
R  A  Drake,  Proc  US  DoD  Explosives  Safety  Seminar,  Aug  1994. 


Figure  1 


MOD(UK)  EXPLOSIVES  RISK  MANAGEMENT 

AN  OVERVIEW 


FREQUENCY  OF  ACCIDENTAL  INITIATION 

12.  Frequencies  may  be  generated  by  two  methods: 

Historical  data  supplemented  by  independent  expert  opinion 
Detailed  failure  mode  analysis. 

The  former  provides  a  table  of  basic  frequency  data  for  a  range  of  generic  classes  of  explosive  and 
weapon  natures.  This  basic  frequency  may  then  be  adjusted  to  take  account  of  other  risk  factors 
such  as  lightning  strikes;  aircraft  crashes;  other  nearby  hazardous  installations,  including 
communication  from  other  explosion  sites;  and  malicious  damage.  The  second  method  generates 
fault  trees  but  this  requires  hard  data  on  failure  modes.  These  data  are  sparse,  due  in  part  of  the  high 
reliability  desigied  into  explosives  articles  and  the  very  low  frequency  of  accidents.  The  ESTC  has 
found  to  date  little  or  no  advantage  in  terms  of  precision  in  using  this  method  and  it  is  not  expected 
to  be  used  in  the  future  except  in  special  and  limited  circumstances. 


CONSEQUENCE  MODELS 


13.  Once  the  total  initiation  frequency  is  known  for  each  potential  explosion  site,  the  next  step 
is  to  determine  the  probability  of  fatality  at  each  exposed  site,  given  an  event  at  eaeh  of  the 
explosion  sites.  The  software  includes  separate  consequence  models  for  assessing  lethality  from 
blast,  weapon  fragments,  building  debris  and  thermal  radiation.  For  Hazard  Divisions  1.1  and  1.2 
aU  of  these  models  except  thermal  radiation  are  combined.  For  Hazard  Division  1 .3  only  the  thermal 
radiation  model  is  used.  There  are,  world  wide,  a  number  of  eonsequenee  models  whieh  might  be 
adopted  to  meet  all  or  part  of  the  requirement.  However,  models  are  only  as  good  as  the  data  on 
which  they  are  founded  and  the  intelligent  use  of  a  model  requires  some  knowledge  of  those  data. 
The  ESTC  QRA  method  employs  only  models  which  are  believed  to  be  physically  sound  and  for 
which  some  assessment  of  supporting  data  is  possible. 

14.  Weapon  fragmentation  data  are  computed  by  assigning  ammunition  to  one  of  six  generic 
types  ranging  from  a  30  mm  HE  round  to  a  1000  lb  bomb.  The  type  seleeted  is  chosen  to  ensure 
a  worst  case  estimate.  Eatalities  from  blast  are  determined  by  a  model  developed  by  David  Hewkin, 
details  of  which  were  published  in  the  proceedings  of  the  1992  DoD  Explosives  Safety  Board 
Seminar‘s.  Other  building  debris  and  thermal  radiation  models  are  derived  from  experimental  and 
historical  data.  Annex  B  lists  the  eonsequenee  models  currently  regarded  as  being  sufficiently  robust 
to  be  employed  in  the  ESTC  QRA  method. 

15.  Clearly,  this  list  of  models  is  not  comprehensive.  Eor  example,  the  model  for  building  debris 
relates  to  brick  walled  constructions  with  reinforced  concrete  roofs.  Results  for  this  type  of  building 
are  available  from  trials  performed  in  Australia  and  are  often  used  to  represent  a  worst  case. 
However,  hardened  aircraft  shelters  and  igloos  represent  the  main  MODUK  explosives  storage 
situations  for  whieh  this  model  is  not  always  appropriate.  In  these  cases  agreed  data  from 
Anglo/US/Australia  trials  ean  be  used  to  generate  a  worst  ease  envelope  which  can  be  applied 
manually  to  generate  an  appropriate  output.  This  means  of  dealing  with  debris  from  these  types  of 
structure  is  seen  as  a  weak  link  in  the  method  and  additional  data  from  current  test  programmes  is 
urgently  required. 

16.  Another  area  of  weakness  is  the  lack  of  techniques  for  assessment  of  risks  arising  from 
transport,  not  least  the  loading  and  unloading  of  ships.  A  literature  survey  and  analysis  was 
conducted  in  the  UK  in  1992  with  the  aim  of  examining  in  risk  terms  the  significance  of  ship  break 
up  in  explosives  incidents  in  ports.  An  assessment  of  the  final  report^  concluded  that  the  quality  and 
quantity  of  the  data  available  did  not  allow  the  development  of  a  quantitative  explosion  effects 
consequence  models.  This  is  increasingly  seen  as  an  important  constraint  given  the  emphasis  now 
plaeed  on  rapid  deployment  and  the  implieations  that  could  have  for  the  transport  of  explosives 
through  commercial  ports. 


“^Consequences  of  Pressure  Blast  :  The  Probability  of  Eatality  inside  Buildings,  D  Hewkin, 
Proeeedings  DoD  EST  Seminar,  Vol  2,  143,  1992. 

^  Erazer-Nash  Consultancy  Etd.  Report  on  Ship  Explosions,  ENC  5055/59 18TN,  1992 


17.  Although  it  is  clear  that  work  is  needed  to  extend  and  improve  the  available  consequence 
models,  it  should  also  be  recognised  that  the  limitations  that  result  from  the  present  inadequacies 
apply  to  both  Q-D  and  QRA  based  controls.  Generally,  the  price  which  must  be  paid  for  inadequate 
consequence  models  is  an  overly  conservative  control  regime. 

CONSTRAINTS 

18.  A  number  of  constraints  on  the  applicability  of  the  QRA  method  have  to  be  recognised 
before  it  can  be  used.  Results  are  sensitive  to  several  factors  including  the  quality  of  the  site 
management  and  of  the  explosives  themselves  and  the  facilities  in  which  they  are  housed.  The 
method  is  valid  only  for  sites  which  are  well  managed,  staffed  by  competent  and  experienced 
personnel  and  which  are  subject  to  regular  external  inspection  to  maintain  standards.  The  adoption 
of  QRA  does  not  mean  that  normal  safety  requirements  can  be  relaxed.  Rather,  the  method 
underlines  the  need  for  these  requirements  to  be  maintained.  Similarly,  the  method  as  developed 
applies  only  to  stores  which  meet  the  normal  requirements  for  safety  and  suitability  for  service, 
which  are  properly  classified  and  packaged  and  which  are  housed  in  properly  constructed  and 
maintained  store-houses.  Any  deviation  from  these  conditions  might  cast  doubt  on  the  reliability  of 
the  assessment. 

19.  It  is  also  important  that  the  assessment  is  carried  out  by  staff  with  experience  of  both  the 
method  itself  and  the  operation  of  explosives  storage  sites.  Manipulation  of  the  input  data  and  of 
the  frequency  and  consequence  models  requires  expert  knowledge  and  understanding  to  ensure 
consistent  application.  The  overall  ESTC  QRA  model  is  not  sufficiently  mature  to  be  handed  over 
for  use  as  a  general  mana^ment  tool.  Indeed,  given  the  specialised  nature  of  the  work  and  the  need 
for  expert  interpretation  of  its  outputs,  it  may  never  achieve  that  status.  The  ESTC  Support  Group 
currently  maintains  a  small  team  to  carry  out  QRA  studies,  drawing  on  staff  from  the  Services  with 
their  specialised  knowledge  to  support  the  effort. 

20.  EinaUy,  it  must  be  recognised  that  any  change  in  site  functions,  in  management  standards  or 
in  any  of  the  underlying  assumptions  behind  an  assessment  must  cause  that  assessment  to  be 
reviewed.  Risk  assessment  is  not  a  once  and  for  all  procedure  and  assessments  should  be  continually 
reviewed  to  ensure  continuing  validity.  The  process  is  labour  intensive  and  expensive.  Risk 
assessment  is  not  a  quick  fix  or  any  easy  option  to  get  round  difficult  problems. 

RISKS  FROM  MOD(UK)  SITES 

21.  The  ESTC  QRA  model  was  developed  with  the  oversight  of  a  Steering  Committee  drawn 
from  MOD  and  other  interested  Government  Departments  and  of  an  Independent  Advisory  Panel. 
In  1994  the  Advisory  Panel  reported  to  Ministers  that  the  method  developed  was  broadly  in  line  with 
developments  in  generally  related  fields  in  industry  as  a  whole.  The  Steering  Committee  finished  its 
work  at  the  end  of  the  main  development  phase  and  oversight  of  further  improvement  was  passed 
to  the  ESTC. 

22.  The  first  stage  of  this  process  has  involved  the  application  of  the  method  to  most  of 
MOD(UK)'s  larger  explosive  storage  facilities.  A  total  of  17  sites  has  now  been  assessed,  including 
some  smaller  and  more  specialised  facilities.  Details  of  results  obtained  at  ten  of  the  larger  sites  have 


been  published .  Nine  of  these  sites  met  ESTC  quantity /distance  requirements  and,  for  these  sites, 
the  maximum  risk  of  fatality  to  an  individual  member  of  the  public  fell  in  the  range  3.9  x  10'^  to  1 
X  10'^  per  year.  More  recent  work  confirms  this  picture  with  risks  to  the  most  exposed  members  of 
the  public  of  the  order  of  1  x  10'^  per  year  or  less.  The  question  must  then  arise  as  to  whether  risks 
of  this  size  can  be  tolerated.  Within  the  UK,  the  Health  and  Safety  Executive  (HSE)  has  taken  a  lead 
in  addressing  the  difficult  question  of  the  tolerability  of  risk,  and  has  developed  a  conceptual 
framework  within  which  the  issue  can  be  discussed,  Eigure  2. 

Figure  2 

MOD(UK)  EXPLOSIVES  RISK  MANAGEMENT 

THE  ALARP  PRINCIPLE 


TOLERABILITY  OF  RISKS 

23.  This  conceptual  framework  draws  heavily  on  the  statutory  requirement  to  demonstrate  that 
risks  are  as  low  as  is  reasonably  practicable  -  the  so-called  ALARP  principle.  It  is  based  on 
individual  risk  but  the  principles  apply  equally  to  societal  risk.  Risks  above  a  certain  level  are  judged 
to  be  intolerable  and  require  immediate  action  to  reduce  them  irrespective  of  cost.  At  a  substantially 
lower  level  is  a  region  where  risks  are  broadly  tolerable;  this  is  a  region  where,  provided  there  is  a 
benefit  to  be  gained  and  proper  precautions  are  taken  the  risk  does  not  cause  us  to  alter  our  normal 
behaviour.  Between  these  two  levels  is  the  important  ALARP  region. 

24.  The  framework  of  Eigure  2  is  expressed  in  terms  of  individual  risk.  It  applies  equally  to 
societal  risk,  the  risk  of  widespread  or  large  scale  detriment  from  the  realisation  of  a  specified 
hazard.  This  is  an  important  but  problematical  concept.  Some  commentators  argue  that  a  single 
event  leading  to  multiple  fatalities  is  less  tolerable  than  a  large  number  of  lesser  events  with  the  same 
overall  lethality.  They  claim  an  aversion  to  such  high  consequence  events.  Supporting  this,  one 


might  note  the  public  concern  following  a  major  air  crash  and  contrast  it  with  the  widespread 
indifference  to  road  accidents.  On  the  other  hand,  is  it  really  justifiable  for  risk  managers  to 
concentrate  on  preventing  low  frequency,  high  consequence  events  with  the  implication  that  it  is 
worth  spending  more  per  life  saved  to  prevent  multiple  fatalities  than  it  is  to  prevent  single  fatalities? 

25.  Societal  risk  is  often  presented  in  the  form  of  a  curve  showing  the  annual  probability  of  a 
specified  event  causing  N  or  more  fatalities,  the  FN  curve.  The  area  under  the  FN  curve  is 
approximately  equivalent  to  the  societal  risk  in  terms  of  annual  expected  average  harm.  As  for 
individual  risk,  we  can  identify  a  region  where,  for  any  value  of  N,  the  risk  is  too  high  to  be  tolerated 
and  another  where  the  risk  is  so  low  as  to  be  negligible.  The  shapes  of  the  curves  defining  these 
regions  will  depend  on  the  view  taken  of  aversion  and  on  other,  site  specific,  factors.  Between  these 
areas  lies  the  ALARP  region. 

26.  In  the  ALARP  region  risks  must  be  reduced,  as  the  law  demands,  so  far  as  is  reasonably 
practicable.  The  test  of  reasonable  practicability  is  that  the  costs  of  extra  safety  should  not  be 
g'ossly  disproportionate  to  the  benefits  accrued.  A  cost-benefit  analysis  is  essential.  The  framework 
of  Figure  2  was  derived  in  the  light  of  UK  legislation  but  it  has  a  broader  applicability  in  that  it 
provides  a  model  within  which  managers  can  use  QRA  to  assist  them  in  decisions  about  the  cost 
effectiveness  of  resource  commitments. 

27.  Determining  criteria  against  which  the  tolerability  of  risks  can  be  assessed  is  difficult. 
However,  the  HSE  has  given  some  guidance  on  this.  The  levels  are  set  not  by  some  absolute 
scientific  law  but  by  what  society  will  tolerate  at  any  given  time.  Almost  certainly  this  degree  of 
tolerance  has  reduced  over  the  years,  people  expect  life  to  become  safer  and  expect  to  die  naturally 
rather  than  by  accident.  On  the  other  hand,  in  time  of  war  greater  risks  would  be  expected  and 
accepted  and  at  any  time  we  might  expect  those  likely  to  benefit  the  most  to  tolerate  the  greater  risk. 
In  the  UK  no  employment  involving  any  significant  number  of  people  is  estimated  to  present  an 
individual  with  more  than  a  1  in  10^  chance  of  death  in  one  year.  This  level  is  often  quoted  as 
defining  the  limit  of  tolerability.  At  the  other  end  of  the  scale,  figures  of  the  order  of  1  death  in  10’’ 
years  are  regarded  as  falling  at  or  close  to  the  limit  where  the  risk  might  be  regarded  as  being 
negligible. 

28.  It  would  be  quite  wrong  to  regard  these  values  as  set  in  tablets  of  stone.  Society's 
expectations  will  undoubtedly  increase,  they  may  vary  from  place  to  place  and,  of  course,  they  may 
well  be  influenced  by  the  size  of  the  tax  bill!  Different  activities  give  different  benefits  and,  in 
societal  risk  terms,  those  most  exposed  to  risk  may  take  a  different  view  from  those  who  benefit  at 
little  risk  to  themselves.  Ultimately,  decisions  on  the  tolerability  of  risk  are  political  rather  than 
technical  but  we  might  reasonably  expect  the  reduction  in  world  tensions  over  the  past  years  to  be 
reflected  in  reduced  tolerability  of  risks  associated  with  defence  activity. 

Whether  that  means  that  the  public  would  expect  a  lower  risk  from  such  activity  than  from,  say, 
nuclear  power  plant  or  chemical  plant  is  another  matter. 

29.  Within  the  UK,  we  have  been  storing  military  explosives  according  to  ESTC  developed 
quantity/distance  criteria  for  many  years  without  problems.  We  believe  that  sites  operated  in  this 
way  generate  risks  which  are  tolerable  but  which  require  continued  attention  to  ensure  they  are 


maintained  at  a  level  as  low  as  is  reasonably  practicable.  If  this  were  not  the  case,  MODUK  would 
not  have  invested  so  heavily  in  licensing,  operator  training,  inspection  and  all  the  other  activities 
designed  to  prevent  accidental  explosions.  It  is  therefore  gratifying  to  see  this  view  confirmed  by 
the  QRA  studies  conducted  to  date  which,  it  must  be  remembered,  give  an  upper  bound  to  the  risk 
presented  by  MOD  licensed  sites. 

30.  Despite  this,  MODUK  continues  to  avoid  setting  tolerability  criteria.  Such  criteria,  which 
must  take  into  account  public  expectation  as  well  as  technical  matters,  can  only  be  derived  from 
political  debate  and  such  debate  still  has  a  long  way  to  run.  Further,  the  values  we  derive  are  upper 
limits,  based  on  particular  assumptions.  They  cannot  necessarily  be  compared  directly  with  risk 
estimates  for  other  activities.  However  that  is  not  to  say  that  QRA  has  no  immediate  or  practical 
applications  to  explosives  safety. 

APPLICATION  OF  QRA  TO  MOD(UK)  SITES 

31.  In  general,  these  applications  fall  into  three  categories.  QRA  helps  to  deal  with  unusual  or 
exceptional  circumstances  outside  the  scope  of  standard  ESTC  guidelines;  it  provides  a  management 
tool  to  help  us  set  up  priorities  for  action  to  further  enhance  the  safety  of  our  explosives  operations, 
and,  finally,  it  allows  a  demonstration  of  compliance  with  risk  assessment  based  law. 

32.  As  already  noted,  before  issuing  a  licence  for  a  MOD(UK)  explosives  facility,  the  Chief 
Inspector  of  Explosives  must  be  satisfied  that,  in  his  professional  judgement,  the  establishment  when 
operating  within  the  terms  of  the  licence  will  generate  risks  which  are  both  tolerable  and  as  low  as 
is  reasonably  practicable  (AEARP).  Analysis  of  the  application  of  the  QRA  method  to  MODUK 
explosives  sites  indicates  that  tolerability  can  be  assumed  to  be  achieved  if  Q-D  standards 
promulgated  by  the  ESTC  are  met  and,  given  that  proper  management  procedures  are  in  place, 
application  of  the  AEARP  principle  should  not  lead  to  any  requirements  for  significant  expenditure 
to  further  reduce  risks. 

33.  The  expectation  is  therefore  that  the  majority  of  MOD(UK)  explosives  storage  sites  will  be 
licensed  according  to  standard  Q-D  rules.  Given  the  supporting  QRA  work,  it  can  be  assumed  that 
sites  licensed  in  this  way  fully  meet  statutory  obligations  provided  they  are  properly  managed.  The 
special  skills  required  to  carry  out  QRA  analysis  are  not  required  of  the  licensing  staff  but  QRA 
underpins  the  Q-D  based  licence.  Q-D  and  QRA  are  not  alternatives,  they  are  complementary. 

34.  If  the  site  is  operating  outside  ESTC  standards,  the  Chief  Inspector  needs  to  consider  the 
implications  of  this  deviation  in  terms  of  additional  risk.  Often  a  technical  or  qualitative  assessment 
will  be  enough  to  confirm  that  the  additional  risks  are  minor  and  that  a  licence  may  be  issued.  On 
occasions,  however,  the  Chief  Inspector  may  require  that  a  QRA  is  completed.  Where  such  an 
assessment  indicates  that  the  risk,  although  increased,  remains  tolerable  then,  subject  to  the 
application  of  the  AEARP  principle,  a  licence  may  be  issued.  Given  the  deliberate  policy  of  MOD 
not  to  set  absolute  criteria  for  tolerability,  the  Chief  Inspector's  decision  on  this  matter  should  be 
based  on  relative  risk,  comparing  the  proposed  operation  with  the  situation  which  might  apply  if 
ESTC  standards  were  met  or,  if  that  is  not  possible,  with  other,  similar  activities  and  with  the  general 
level  of  risks  posed  by  MODUK's  explosives  handling.  As  a  rule  of  thumb,  any  activity  which  posed 
a  risk  to  an  individual  more  than  one  order  of  magnitude  greater  than  the  norm  based  on  the  ESTC 


QRA  method  would  require  very  careful  consideration  and  it  would  be  very  difficult  indeed  to  justify 
any  activity  which  posed  a  risk  two  orders  of  magnitude  greater  than  that  norm. 

35.  In  the  rare  cases  where  a  Chief  Inspector  feels  he  cannot  issue  a  licence,  his  higher  command 
chain  may  authorise  him  to  do  so,  provided  the  risk  affects  only  MOD  personnel  or  contractors  and 
others  working  within  the  MOD  owned  and  controlled  site,  and  provided  that  the  defence  need 
justifies  the  additional  risk.  In  every  case  where  the  assessed  risk  to  the  general  public  is  an  obstacle 
to  issuing  a  licence.  Ministers  must  be  consulted.  Underlying  these  procedures  is  the  principle  that 
authorisation  of  the  issue  of  a  licence  implies  acceptance  of  the  risks  placed  on  employees  and  the 
general  public  by  the  individual  giving  the  authority. 

36.  The  second,  and  extremely  valuable,  role  of  QRA  is  as  a  management  tool.  There  is  a 
continuous  public  pressure  to  see  risks  reduced,  a  pressure  which  is  reflected  and  politically  endorsed 
in  the  ALARP  principle,  but  resources  are  finite.  QRA  provides  a  tool  for  setting  priorities  to  ensure 
that  the  limited  resources  available  are  used  to  best  effects.  It  allows  a  direct  comparison  of  the 
overall  risks  of  different  establishments  and,  within  a  site,  it  allows  the  major  contributors  to  the  risk 
to  be  identified  and  the  effectiveness  of  proposed  risk  reduction  measures  to  be  assessed. 

37.  Finally,  and  perhaps  obviously,  where  health  and  safety  law  is  based  on  risk  management 
principles,  QRA  provides  a  clear  indicator  of  compliance  with  the  law.  It  is,  or  should  be,  a 
transparent  procedure,  capable  of  informing  public  debate  and  allowing  interested  parties  to  agree 
on  at  least  one  side  of  the  risk/benefit  equation.  Risk  assessment  and  communication  of  information 
on  risk  to  the  general  public  is  an  important  facet  of  current  moves  towards  more  open  government, 
which  is  necessarily  bringing  expert  judgements  into  an  arena  where  they  can  be  subject  to  public 
scrutiny. 

FUTURE  DEVELOPMENT 

38.  When  work  on  the  ESTC  QRA  method  began  in  1983,  it  was  acknowledged  that  it  would 
take  two  decades  or  more  before  the  system  reached  full  maturity.  This  view  recognised  both  the 
technical  and  political  progress  which  would  be  required  to  place  QRA  on  the  same  footing  as 
quantity/distance  based  guidance.  There  is  no  reason  today  to  question  the  accuracy  of  that  original 
forecast. 

39.  Politically,  progress  has  been  made  and  risk  management  is  increasingly  seen  in  the  UK  as 
a  useful  approach  to  the  statutory  control  of  health  and  safety  at  work.  Risk  management  places  the 
ownership  and  control  of  risk  firmly  where  it  belongs,  on  the  risk  generator.  Further,  risk 
management  based  legislation  is  seen  as  preferable  to  prescriptive  legislation,  as  a  means  of  reducing 
non  essential  regulatory  controls.  A  review  has  begun  of  the  Explosives  Acts  of  1875  and  1923. 
This  review  will  bring  the  control  of  the  larger  explosives  storage  sites  into  line  with  that  of  other 
sites  such  as  chemical  plants  which  present  a  major  hazard  to  the  workforce  and  the  surrounding 
population.  It  seems  certain  that  the  new  Regulations  which  result  will  be  goal  based,  requiring  the 
risk  generator  to  provide  adequate  controls  to  ensure  public  safety.  Risk  assessment  will  be  an 
essential  part  of  this  process. 


40.  However,  there  is  still  some  way  to  go  before  we  have  any  good  understanding  of  the  public 


perception  of  risk  or  any  way  of  persuading  those  at  risk  that  they  should  accept  the  situation 
because  of  perceived  benefits  to  others.  Related  to  this  is  the  difficulty  surrounding 
absolute  tolerability  limits.  This  remains  a  political  rather  than  a  technical  issue  and  progress  will 
inevitably  be  slow  while  QRA  techniques  are  immature. 

41.  Technically,  and  confining  our  attention  to  explosives  safety,  it  is  unlikely  that  the  first  part 
of  the  QRA,  the  estimation  of  initiation  frequencies,  can  be  radically  improved.  This  depends, 
among  other  things,  on  accidents  and  these,  we  hope,  are  few  and  far  between.  Therefore,  the 
frequency  part  of  the  ESTC  QRA  method  is  unlikely  to  change  substantially  in  the  foreseeable 
future. 

42.  Consequence  models  present  a  different  picture.  Here  there  is  a  substantial  amount  of  work 
underway.  Within  the  UK,  ESTC  is  working  with  the  HSE  to  identify  models  which  can  be 
demonstrated  to  be  technically  sound.  NATO  nations,  and  Australia,  are  also  involved  in 
complementary  activities  and  trials  work  to  provide  data  against  which  models  can  be  assessed  is 
underway.  Within  NATO,  work  on  an  explosives  safety  risk  assessment  manual  is  also  ongoing. 

43.  The  ESTC  QRA  method  as  currently  structured  is,  strictly  speaking,  limited  in  scope  to 
explosives  storage  sites,  with  a  capability  to  assess  processing  and  on-site  storage  risks.  Work  is  now 
beginning  to  extend  that  scope  to  include  transport  hazards  more  generally  and  to  provide  techniques 
for  assessing  ports  and  dockyards.  These  areas  are  well  suited  to  international  collaboration  and  the 
ESTC  would  be  happy  to  be  involved  in  such  activity. 

CONCLUSIONS 

44.  QRA  is  now  available  as  a  proven  and  useful  technique  for  the  management  of  risks 
associated  with  the  storage  of  explosives.  As  a  method,  it  places  ownership  and  control  of  the  risk 
on  the  risk  generator,  requiring  him  to  justify  continuing  to  maintain  the  risk  at  present  levels  or  to 
invest  resources  to  reduce  it.  However,  the  method  itself  is  expensive  to  apply;  it  requires  experts 
to  handle  the  data  input  and  processing  and  to  interpret  the  output.  Eurther,  criteria  against  which 
to  jud^  those  outputs  are  politically  sensitive.  Decision  makers  need  to  be  aware  of  the  limitations 
of  the  method  and  the  uncertainties  inherent  in  risk  assessment. 

45.  It  is  therefore  the  view  of  the  MODUK  ESTC  that  Q-D  standards  should  remain  the  basis  for 
ensuring  the  safety  of  explosives  storage  and  transport  operations,  QRA  should  be  used  to  underpin 
those  standards,  demonstrating  compliance  with  risk  based  legislation,  and  to  deal  with  unusual  or 
exceptional  circumstances.  Investment  in  developing  QRA  techniques  is,  in  our  view,  essential  but 
it  is  not  an  easy  option. 


GLOSSARY  OF  TERMS 

Hazard 

Risk 

Individual  risk 

Societal  risk 

Risk  assessment 

Quantified  Risk 
Assessment  (QRA) 

Tolerable 

Risk  management 

Risk  control 

Maximum  credible 
event  (MCE) 


ANNEX  A 


Tbe  disposition  of  a  thing,  a  condition  or  a  situation  to  produce  injury.  A 
hazard  can  simply  be  regarded  as  something  with  the  potential  to  cause 
harm. 

The  likelihood  that  the  harm  from  a  particular  hazard  is  realised;  the  chance 
of  something  adverse  happening.  The  idea  includes  both  the  probability  of 
something  harmful  occurring  and  the  consequences  of  that  occurrence. 

The  risk  of  some  specified  event  or  agent  harming  a  statistical  or 
hypothetical  person  assumed  to  have  representative  characteristics.  This 
does  not  necessarily  assume  an  'average  person'.  It  may  be  the  person  most 
exposed. 

The  risk  of  widespread  or  large  scale  detriment  from  the  realisation  of  a 
specified  hazard.  Societal  risk  is  often  presented  in  terms  of  the  probability 
per  year  of  a  specified  event  causing  N  or  more  fatalities  (fN  curve). 

An  estimation  of  the  risks  arising  from  all  identified  hazards  with  a  view  to 
their  control,  avoidance  or  to  a  comparison  of  risks. 

A  risk  assessment  incorporating  numerical  estimates. 


The  range  of  risk  levels  which  is  deliberately  run  on  a  regular  basis  for  a 
benefit.  A  range  which  is  not  regarded  as  negligible  or  something  which 
might  be  ignored  but  rather  as  something  to  be  kept  under  review  and 
reduced  further  if  and  so  it  is  possible  to  do  so. 

The  application  of  a  set  of  measures  relevant  to  a  particular  set  of 
significant  risks  and  intended  to  restrict  and  maintain  risks  within  tolerable 
limits  at  proportionate  costs. 

The  overall  activity  of  identifying  and  limiting  or  managing  risks.  The  term 
includes  a  concept  of  achieving  evenness  in  the  distribution  of  risk  and  of 
proportionality  to  risk  in  allocating  expenditure. 

The  worst  single  event  likely  to  occur  from  the  accidental 
explosion  of  a  given  disposition  and  quantity  of  ammunition  and  explosives. 
The  event  must  be  realistic  with  a  reasonable  probability  of  occurrence. 
The  MCE  may  be  used  as  a  basis  for  effects  calculations. 


CONSEQUENCE  MODELS 


ANNEX  B 


Above  ground 

Variables 

Reference 

Short  Name 

DRIC  Ref 

Blast  -  Indoors 

NEQ 

Distance 

RAST  1539 

PRESOl 

BR325887 

Blast  outdoors 

NEQ 

Distance 

RAST  1554  & 
Hewkin  DODESB 
1992 

PRESOl 

BR325886 

Weapon  Fragments 

NEQ 

Distance 

Weapon  Type  (Frag  density,  max 
velocity,  max  frag  weight) 

Exposed  Site  -  In/Outside 

PES  -  Traversed/Untraversed 

RAST  1691 

ROERAP 

BR325905 

Building  Debris 

ESH 

NEQ 

Distance 

PES  dimension  (Length,  Width  & 
Height) 

Wall  Thickness. 

RAST  1454 
(MoD  Trials 
Henderson) 

ERAGSOl 

BR325880 

Building  Debris 
Igloo/HAS 

NEQ 

Distance 

RAST  1721 
(In  course  of 
preparation  with 
Distant  Runner  trial 
data.) 

Thermal  Rad 

NEQ 

Distance 

RAST  1543 
(Historical  MoD 
results) 

TRADOl 

BR325889 

Below  ground 

Blast 

NEQ 

Distance:  Angle  to  Adit  Normal 

Depth  of  Cover 

Eree  Volume 

RAST  1692 

FATBLAST 

BR325906 

Weapon  Fragment 

No  significant  contribution 

RAST  1701 

N/A 

BR325907 

Dehris 

NEQ 

Distance 

Volume  of  Blown  Cover 

RAST  1520 
(China  Lake. 
Jarret) 

UFRAGl 

BR325885 

Thermal  Rad 

NEQ 

Distance 

Loading  density  (Blast  model) 
Volume  of  Chamber 

Area  of  exit  from  chamber 

RAST  1577 

THERM 

BR325894 

